Skip to content

v1.4.0 — DOMPurify XSS

Choose a tag to compare

View all tags
@ianclemence ianclemence released this 23 May 09:50
· 37 commits to main since this release
v1.4.0
5e984b3

Implemented Changes

  • DOMPurify XSS sanitization

    • Added DOMPurify CDN script to the head: index.html
    • Sanitized compiled Markdown HTML before injecting into the preview, with an allowlist regex that permits attachment: and blob: (plus http, https, mailto, data): updatePreview

  • Offline mode (Service Worker caching)

    • Added Service Worker registration during init: index.html
    • Implemented caching Service Worker (app shell + CDN assets): sw.js

  • Performance (Search debouncing)

    • Debounced global search execution by 300ms: index.html

  • Performance (Web Worker for LCS diff)

    • Moved LCS/diff computation into a Web Worker (inline blob worker code), added async diff rendering with a loading state: history diff worker + openHistoryDiff

  • Programmatic event binding (removed inline handlers)

    • Removed all inline onclick="..." handlers and bound actions in JS (toolbar format buttons, dropdown items, panel/modal close buttons): setupEventListeners

Quick Verification Checklist

  • XSS: type <img src=x onerror=alert(1)> or <script>alert(1)</script> in the editor → preview should not execute.
  • Offline: load once online → then DevTools “Offline” + refresh → app and CDN features should still load (after SW install/activation).
  • Search: type into global search → results should update after ~300ms pause.
  • Diff: open a history diff → should show “Computing diff…” briefly and stay responsive.
Assets 2
Loading